All Questions

0
votes
0answers
30 views

Guessing 3DES key from weak keys [closed]

I have CPU access which has a static cipher key in register 0x00. I want to guess the key present in register 00 which is actually a master key used to encrypt/decrypt all other keys. Is there any way ...
0
votes
0answers
44 views

Isogeny of elliptic curve

If we have two elliptic curves $E$ and $E'$ and the points of both elliptic curves are same. Then all the points of $E$ map to all the points of another elliptic curve $E'$. For example $E$ has ...
0
votes
0answers
77 views

Is it possible for an attacker to determine the original input to the S-Boxes in DES?

I am learning about DES, a Feistel 64-bit block cipher with 16 rounds. Is it possible that an intruder can determine the original input to the S-Boxes?
0
votes
1answer
47 views

What is the significance of $\prod \limits_{i=1}^{t}m_i > p \prod \limits_{i=1}^{t-1}m_{n-i+1}$ in Asmuth–Bloom threshold SSS?

In this paper by Asmuth–Bloom on threshold SSS, the algorithm is as follows: Shares Distribution To distribute $n$ shares of a secret $K$ among the set of participants $P = \{ p_i : 1 ≤ i ≤ n\}$, ...
1
vote
0answers
54 views

Guessing the key in AES256-GCM?

I assume that my case is weird but I've the following information: IV: 0x263e or 0x3e26 Auth tag: 0x25 AES256-GCM encrypted payload: 0x4eec96df534ade4c013a AES256-GCM decrypted payload: ...
0
votes
0answers
41 views

Patarin’s H-Coefficient Technique

I have come across many paper that applies Patarin’s H-Coefficient Technique in various cryptographic securities (KPA, CPA, CCA,...). I am asking kindly if someone could explain it simple with ...
0
votes
1answer
30 views

Problem in generation of keys in KP-ABE

In KP-ABE the owner encrypts the message using attributes say a'. The Attribute authority(AA) designs an access structure and implants that access structure in keys generated by AA for the user. So, ...
0
votes
0answers
22 views

How does the order of a group, it's torsion subgroup and the co-factor link?

Given an elliptic curve that defines some group of non-prime order, with co-factor h. Would it then have a h-torsion subgroup? What are the implications for ECC ...
0
votes
0answers
10 views

Python 3.x Cryptography Fernet / AES256 Is this safe and secure? [migrated]

I wrote this code to make easy use of the Python library Cryptography https://cryptography.io/en/latest/ to encrypt data Is this safe and secure given the user inputs a strong password? ...
42
votes
2answers
5k views

How is the Swiss post e-voting system supposed to work, and how was it wrong?

I read that the Swiss post had an e-voting solution developed, made it possible to obtain the source code for review, and that vulnerabilities were found. Apparently we are not talking about the ...
1
vote
1answer
80 views

Key-Exchange in Steganography

I know there are key-exchange methods in Cryptography. But in case of Secret-key Steganography, what actually stego-key means and how can we use the key and once used how we exchange that with the ...
1
vote
1answer
33 views

How is an IV used in a Merkle-Damgard construction- Explicit example

I am interested to know how an IV is used in this simple Merkle-Damgard construction. I am referring to this image from the associated Wikipedia page as I explain further. For the purpose of ...
0
votes
1answer
35 views

LWE: does using only a small subspace of the plaintext space influence the security of the encryption scheme?

Regarding LWE schemes where the encryption is performed this way: for $m \in \mathbb{Z}_t$, compute $c = LWE_{\mathbf{s}}^{t/q}(m) = \{ \mathbf{a}, \mathbf{a \cdot s} + m\cdot q/t + e\} \in \mathbb{Z}...
1
vote
1answer
68 views

How do the Serpent S-boxes work?

For DES, you take the 4 inner bits as the column to choose from the S-Box, and the two outer bits to choose the row. However, for Serpent it doesn't make sense to me as the prekeys that are used to ...
0
votes
1answer
55 views

Are there any homomorphic first and second preimage resistant (cryptographic) hash functions?

Are there any homomorphic cryptographic hash functions that satisfy $\text{H(A + B)} = \text{H(A)} + \text{H(B)}$ which maintaining pre-image resistance
0
votes
1answer
28 views

Extractor for Oblivious Transfer Protocol

In a paper that I have been reading (https://cs.nyu.edu/~ganesh/zk.pdf), in one of the proofs, this has been said: The simulator works as follows: It uses the OT simulator to extract the prover’s ...
0
votes
0answers
57 views

Calculating the inverse for a Rijndael s-box [duplicate]

I want to calculate a Rijndael S-box but something went wrong. How can I calculate the inverse? In the following is my approach: given: $f(x)=x^8+x^4+x^3+x+1 \rightarrow$ binary: 100011011 0x12 = ...
0
votes
1answer
53 views

Does it matter if IV is used as the first block of data before the encryption and then some fixed value is used for the actual IV? [duplicate]

Usually the IV for the crypto operations is chosen randomly and is sent together with the encrypted data [at the first block]. For decryption, the IV is first extracted from data and set separately in ...
0
votes
0answers
30 views

triple-des simple questtion [duplicate]

Why do we use encrypt-decrypt-encrypt (EDE) in 3DES, rather than encrypting three times? in this link, we use EDE Mode usually. when we use one key, in this case, Encryption -> Decryption result ...
3
votes
1answer
62 views

Can I replace DH by a post-quantum key exchange in IBAKE for post-quantum identity-based authenticated key exchange?

IETF RFC 6539 IBAKE - Identity Based Authenticated Key Exchange describes a Hybrid key exchange using both Identity based cryptography and a standard ephemeral elliptic curve Diffie-Hellman key ...
6
votes
2answers
628 views

Compression function is not collision resistant but Merkle-Damgard is collision resistant

Is it possible that you can still have a collision resistance in Merkle-Damgard even if the compression function has a collision?
4
votes
3answers
145 views

Is Identity-based encryption used in the wild?

I have a curious question. Is Identity-based encryption used in the wild?
1
vote
1answer
48 views

AES-GCM cipher tag and IV size, while attempting to render encrypted ciphertext useless by removing them

I'm using AES in GCM mode of operation for encryption/decryption & authentication of segments of data in a file. The layout of each segment can be summerized by this diagram. Each segment is ...
-1
votes
0answers
18 views

Hash prediction [duplicate]

Is it conceivable that a deep learning algorithm could find a way to make educated an guess about what hash an input will produce? I'm not talking about the whole thing. But let's say you just want to ...
0
votes
0answers
35 views

I calculated multiplicative inverses of my polynomial in AES using the EEA. How do I find the multiplicative inverses using Fermat's Little Theorem? [duplicate]

How do we find multiplicative inverses using Fermat's Little Theorem? I have the basic understanding of how we compute inverses of numbers, but can someone help with calculating inverses of ...
0
votes
0answers
29 views

Aes brute force when part of data known [duplicate]

I have buffer of 16 bytes that encrypt with AES 128 cbc with IV =000000......(all IV is 0) I have the encrypted buffer, and I know 7 bytes from 16 bytes before the encryption , I dont know the key . ...
1
vote
1answer
35 views

While doing the affine mapping after calculating the inverse of my polynomial using the EEA, I am not getting the value of the inverse as it should be

This is the image of matrix multiplication. It is the affine mapping step in the s box layer of AES. My value is not what it should be, therefore I just wanted it to be confirmed by someone else. I'...
0
votes
0answers
45 views

Deterministic generation of RSA keys for IPFS / OrbitDB [duplicate]

I am in the process of working on a decentralized application using IPFS and OrbitDB. IPFS uses 2048 bit RSA keys for the Node runtime peer-id and secp256k1 for read/write access in OrbitDB. For ...
5
votes
2answers
276 views

Difference on montgomery curve equation between EFD and RFC7748

There is a subtle difference between the 2 implementations for a Montgomery curve defined from the 2 following links https://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html A = X2+Z2 AA = ...
0
votes
0answers
50 views

Security of (2,2) Shamir's visual secret sharing scheme : How are the 2 shares random?

From the Visual Cryptography by Shamir and Noar. Let us take the pixel expansion as 2. Therefore, each pixel will be represented by 2 pixels (also called as subpixels) in a share. Since this is a (2,...
2
votes
2answers
123 views

When does multiple OTP encryption become insecure if new keys are permuted? ​

I understand that OTP encryption fulfils perfect secrecy, meaning you can't decrypt the encrypted text to it's original plaintext (and know that this plaintext is indeed the original plaintext) unless ...
0
votes
0answers
31 views

Blinding factor SEAL

For a protocol, I need to blind a ciphertext. I am not sure how to choose the blinding factor. How should I choose the range? What should I consider to offer security? I am using CKKS scheme, the one ...
0
votes
1answer
46 views

Extended Euclidean Algorithm in RSA [duplicate]

I am trying to solve an RSA problem. In order to calculate $d$, I have to calculate $d$ with $e=3$ and $$d\cdot e\equiv1 \pmod{40}$$ Obviously the answer is $d=27$, but I want to solve this with the ...
6
votes
0answers
69 views

Differences between “NewHope” and “NewHope-simple”

The well-known paper described a key exchange (KE) scheme named "NewHope" on USENIX 2016. The authors then proposed "NewHope-Simple" - a PKE/KEM scheme. They also submitted "NewHope for NIST" - ...
0
votes
0answers
17 views

Converting RSA public key from der to pub [migrated]

I have a public RSA key in der format which I have to use as integration mechanism for encryption. Problem is that when I am trying to use that key with node crypto library, it is throwing error. In ...
3
votes
0answers
68 views

How would we design a fast circuit to solve LCS35?

LCS35 is a time-lock puzzle, stated in Ronald L. Rivest's Description of the LCS35 Time Capsule Crypto-Puzzle [1] (April 1999). That instantiates a system in Ronald L. Rivest, Adi Shamir and David A. ...
1
vote
0answers
35 views

Proving a scheme's EAV-insecurity

EDIT: The instructor clarified that part (a) was wrong. He declined to indicate why. I can share more details of the prompt if need be. I apologize again if this question is too low-level; it comes ...
0
votes
0answers
10 views

I need help understanding bit order in DES [migrated]

I'm using a variety of references to study this algorithm, among others Christof Paar's book and classes. Currently I'm working on a custom C implementation of the algorithm, and am trying to ...
0
votes
1answer
43 views

What does the minimal number of round of “nr” use Keccak to avoid “collision attack”?

What does the minimal number of round of "nr" use Keccak to avoid collision attack? $$nr = 12+2L$$
5
votes
0answers
56 views

Time-memory tradeoffs in Shor's algorithm

Can a quantum computer with insufficient qubits to factor an integer of a given size make any progress in factoring it? For example, what if quantum computer is only one qubit short of what is ...
0
votes
1answer
35 views

Showing the non-pseudorandomness of a generator

I'm sorry if this question is too novice. It comes from a practice midterm in a cryptography course which I'm taking, and my confusion here is really that I don't know the "tools" that one uses in ...
0
votes
1answer
47 views

Secret modular exponentiation with chosen modulus

Let $e$ be a secret value and $n$ a public 2048-bit RSA modulus. Consider the RSA encryption under the key $(e, n)$ with unknown $e$. The goal is to decrypt a given ciphertext $c=m^e \pmod{n}$ to ...
0
votes
1answer
76 views

How many bytes of data does AES 256 encrypt at one time?

Since the block size of AES 256 is 256, how would we calculate the bytes of data AES 256 encrypts at one time?
2
votes
0answers
27 views

Key confirmation and other benefits of double ratchet

I'm trying to understand a comment from the Signal blog post Advanced cryptographic ratcheting. This article uses the term OTR ratchet to refer to a simple asymmetric DH ratchet, where Alice ...
2
votes
1answer
53 views

Can anyone elaborate why KP-ABE is better than CP-ABE for television program broadcasting?

I know the difference between KP-ABE and CP-ABE. I am not able to understand why KP-ABE is better for broadcasting than CP-ABE ?
0
votes
0answers
4 views

Problems in installing Charm Crypto on Raspberry Pi 3 [migrated]

I am trying to install Charm crypto library on Raspberry Pi 3, everything works fine but make and make install fails as shown in attached screenshots 2 and 3. The configuration is successful . The ...
0
votes
0answers
8 views

Disabling the AES cipher suites without ECDHE key exchange algorithm [migrated]

Currently, we are having below cipher suites used in our platform. AES128-GCM-SHA256 AES128-SHA256 AES128-SHA ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA Post ...
0
votes
0answers
16 views

Cryptanalysis of an OTP RFID tag transmission using multiple transmissions [duplicate]

A scanner encrypts a 32 bit message 'x' using a secret 32 bit key 's1' and sends the resulting cipher y= x XOR s1 to an RFID tag. The Tag decrypts the message 'x' ,and then encrypts the message 'x' ...
0
votes
1answer
31 views

How would I convert an arithmetic circuit into a system of bilinear equations?

Given an arithmetic circuit, are there any examples of turning it into a system of bilinear equations, with the end goal of turning it into a matrix?
0
votes
0answers
32 views

Audio Files and Digital Bearer Instruments

Is it possible to combine Audio Files and Public Key Cryptography creating a Digital Bearer Audio File that is in complete control of the owner who would then have the ability to grant access to ...

15 30 50 per page